In a multi-tenant GCP project with resources grouped into separate folders, what is the appropriate IAM role and assignment level for granting billing-related permissions to each tenant’s billing manager?

*The correct IAM role to assign to each tenant’s billing manager in a multi-tenant GCP project, where resources are organized into separate folders, is the 'Project Billing Manager' role at the Folder level. This role assignment ensures that billing managers have the necessary permissions to manage billing for the resources within their respective tenant’s folder. The Project Billing Manager role at the Folder level allows managers to oversee billing aspects of projects contained within the folder, aligning with the organizational structure of the multi-tenant environment. This setup restricts access appropriately, ensuring that billing managers can only manage and view billing information related to their specific tenant resources, thereby maintaining organizational boundaries and privacy. Other roles, such as Billing Account Viewer or Billing Account Administrator, either provide too broad or too limited access, or are not correctly aligned with the required resource and permission granularity.*